CVE-2018-5103: Use After Free

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firefox 58...

Apple will let users run iOS apps on macOS

Apple is making it easier for mobile developers to port their iOS apps to the next-generation macOS Mojave desktop platform—a major step in bringing the two platforms closer together. However, at the same time, the company straightforward denied the idea of merging the iPhone and Mac operating...

Debian DSA-4213-1 : qemu - security update (Spectre)

Several vulnerabilities were discovered in qemu, a fast processor emulator. - CVE-2017-15038 Tuomas Tynkkynen discovered an information leak in 9pfs. - CVE-2017-15119 Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service. -...

Detecting Lies through Mouse Movements

Interesting research: "The detection of faked identity using unexpected questions and mouse dynamics," by Merulin Monaro, Luciano Gamberini, and Guiseppe Sartori. Abstract: The detection of faked identities is a major problem in security. Current memory-detection techniques cannot be used as they...

CVE-2018-10962

An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because mouseevent is not properly considered...

2345 Security Guard Process Protection Bypass Vulnerability

2345 Security Guard is a set of computer security protection software from China's 2345 Corporation. A process protection bypass vulnerability exists in 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe in 2345 Security Guard 3.7.0, which occurs because mouseevent is not properly considered...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2018:0361-1)

This update for MozillaFirefox to version ESR 52.6 fixes several issues. These security issues were fixed : - CVE-2018-5091: Use-after-free with DTMF timers bsc1077291. - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation bsc1077291. - CVE-2018-5096: Use-after-free whi...

Mozilla: Use-after-free during mouse event handling (MFSA 2018-03)

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firefox 58...

Windows 10 April 2018 Update (v1803) – Citrix Known Issues

Microsoft releases software updates for Windows 10 twice a year through the Semi-Annual Channel. On April 30, 2018, Microsoft released its latest Semi-Annual Channel release for Windows 10 called 'April 2018 Update' v1803. This article is intended to capture known issues with Windows 10 v1803 tha...

Mozilla: Use-after-free during mouse event handling (MFSA 2018-03)

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firefox 58...

UBUNTU-CVE-2018-5103

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firefox 58...

PT-2018-16782

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 58 Firefox ESR versions prior to 52.6 Thunderbird versions prior to 52.6 Description A use-after-free issue can occur during mouse event handling due to problems with multiprocess support, resulting in a potentially...

TeamViewer Permissions Vulnerability (macOS)

According to its version number, the TeamViewer install on the remote macOS or Mac OS X host is a version prior to 11.0.73955, 12.0.82953, or 13.0.5640. It is, therefore, affected by a permissions vulnerability than can result in unauthorized remote control. During an authenticated connection it...

TeamViewer Permissions Vulnerability (Windows)

According to its version number, the TeamViewer install on the remote Windows host is a version prior to 11.0.89975, 12.0.89970, or 13.0.5640. It is, therefore, affected by a permissions vulnerability than can result in unauthorized remote control. During an authenticated connection it may be...

Mouse Offset Behavior During Multiple ICA Session in Receiver for Windows and Windows (Store)

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Attempting to run multiple ICA sessions simultaneously, may cause high memory and Disk I/O activity,...

TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change

TeamViewer Permissions Hook V1 --- A proof of concept injectable C++ DLL, that uses naked inline hooking and direct memory modification to change TeamViewer permissions. Features As the Server - Enables extra menu item options on the right side pop-up menu. Most useful so far to enable the "switc...

Websites Use Session-Replay Scripts to Eavesdrop on Every Keystroke and Mouse Movement

The security researchers at Princeton are posting You may know that most websites have third-party analytics scripts that record which pages you visit and the searches you make. But lately, more and more sites use "session replay" scripts. These scripts record your keystrokes, mouse movements, an...

Logic design flaws in Tap Tech's smart CAPTCHA system

Smart CAPTCHA system is a new generation of Internet CAPTCHA system. A logical design vulnerability exists in the Smart CAPTCHA System of Point and Click Technology. An attacker can bypass the graphical CAPTCHA of the mouse-click method by modifying the status code, which can be utilized to bypas...

P4wnP1: A Open Source USB Attack Platform

PenTestIT RSS Feed As of now, hardware security projects seem to be attracting me more than software based projects. Evidently, I wrote a few posts covering them - List of Portable Hardware Devices for Penetration Testing, List of Raspberry Pi DIY Projects for Anonymity, etc. among other awesome...

Mouse and Keyboard functions become unresponsive when launching or refreshing agent if it is not bound to a WEM Configuration Set.

If the WEM agent, vuemUIAgent.exe, is launched or refreshed when it is not bound to a "Configuration Set" inside the WEM Administration Console, the keyboard and mouse functions lock. The WEM Agent in question is in the following screenshot: This is a known issue where keyboard/mouse hooks are no...